aa4ff6b03e2b22f226a68619c989741b347bd5d368572cf2b44de9f26391dab4 | Triage

Analysis

max time kernel
137s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:29

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

88KB
MD5

fedd26508dcb1eabf81c740445f21920
SHA1

4fbc709326f0319e33e2280f4342d48636e6d600
SHA256

c9a303536c09d1cd0a408b9ee7d9f7492942aa3996c93b9a8160004a36abb3ef
SHA512

380e9f1ab195dc9742f05fd0a749088163b701d3c9c7c5158e2aa8fcdd9d78cfa51c9cd61e1e3e09ef4bdb6a17d2e8a692e0b80c8a3983c773f213bc788e6489
SSDEEP

1536:2MiymAUX0Tdy5EQwNsZxFViGshnEGUevUBrO:finAUX0T0+QwgxDiL2GUevCy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 5044	2584	rundll32.exe	87
PID 2584 wrote to memory of 5044	2584	rundll32.exe	87
PID 2584 wrote to memory of 5044	2584	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:5044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5044-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download